admin/klezVirus-NimlineWhispers3
1
0
Fork 0
mirror of https://github.com/klezVirus/NimlineWhispers3 synced 2026-06-08 15:18:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix minor issues with CLI

Browse Source
This commit is contained in:
d3adc0de
2022-05-29 18:40:22 +01:00
parent 6472729873
commit 2eb3bc9373
3 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+4 -1
View File
@@ -8,4 +8,7 @@ __pycache__
# Non-Nim files
*.asm
*.c
*.h
*.h
# Tests
tests
NimlineWhispers3.py
+1 -1
View File
@@ -15,7 +15,7 @@ class NimlineWhispers:
def __init__(self, debug, randomise, nobanner, **kwargs):
# initialise class instance of SysWhispers3 so we can generate stubs and fetch seed values later
kwargs["debug"] = kwargs.pop("sw_debug")
kwargs["debug"] = kwargs.pop("sw_debug") if "sw_debug" in kwargs.keys() else False
kwargs["recovery"] = SyscallRecoveryType.from_name_or_default(kwargs.pop("method")) if kwargs.get("method") else SyscallRecoveryType.EMBEDDED
kwargs["arch"] = Arch.from_string(kwargs.pop("arch")) if kwargs.get("arch") else Arch.x64
kwargs["compiler"] = Compiler.from_string(kwargs.pop("compiler")) if kwargs.get("compiler") else Compiler.MSVC
syscalls.nim
+7 -7
View File
@@ -11,7 +11,7 @@
#include <windows.h>
#define SW3_SEED 0x5DAC90EC
#define SW3_SEED 0x8C3FEF96
#define SW3_ROL8(v) (v << 8 | v >> 24)
#define SW3_ROR8(v) (v >> 8 | v << 24)
#define SW3_ROX8(v) ((SW3_SEED % 2) ? SW3_ROL8(v) : SW3_ROR8(v))
@@ -338,7 +338,7 @@ proc NtResumeThread*(ThreadHandle: HANDLE, PreviousSuspendCount: PULONG): NTSTAT
mov [rsp+24], r8
mov [rsp+32], r9
sub rsp, 0x28
mov ecx, 0x010B64D87
mov ecx, 0x00C4EC2EC
call SW3_GetSyscallNumber
add rsp, 0x28
mov rcx, [rsp+8]
@@ -357,7 +357,7 @@ proc NtAllocateVirtualMemory*(ProcessHandle: HANDLE, BaseAddress: PVOID, ZeroBit
mov [rsp+24], r8
mov [rsp+32], r9
sub rsp, 0x28
mov ecx, 0x00B9D610F
mov ecx, 0x07FE94947
call SW3_GetSyscallNumber
add rsp, 0x28
mov rcx, [rsp+8]
@@ -376,7 +376,7 @@ proc NtClose*(Handle: HANDLE): NTSTATUS {.asmNoStackFrame.} =
mov [rsp+24], r8
mov [rsp+32], r9
sub rsp, 0x28
mov ecx, 0x00ADBF09B
mov ecx, 0x04E9AC38B
call SW3_GetSyscallNumber
add rsp, 0x28
mov rcx, [rsp+8]
@@ -395,7 +395,7 @@ proc NtCreateThreadEx*(ThreadHandle: PHANDLE, DesiredAccess: ACCESS_MASK, Object
mov [rsp+24], r8
mov [rsp+32], r9
sub rsp, 0x28
mov ecx, 0x044A6049E
mov ecx, 0x07E903445
call SW3_GetSyscallNumber
add rsp, 0x28
mov rcx, [rsp+8]
@@ -414,7 +414,7 @@ proc NtOpenProcess*(ProcessHandle: PHANDLE, DesiredAccess: ACCESS_MASK, ObjectAt
mov [rsp+24], r8
mov [rsp+32], r9
sub rsp, 0x28
mov ecx, 0x0692D946C
mov ecx, 0x0E19FE213
call SW3_GetSyscallNumber
add rsp, 0x28
mov rcx, [rsp+8]
@@ -433,7 +433,7 @@ proc NtWriteVirtualMemory*(ProcessHandle: HANDLE, BaseAddress: PVOID, Buffer: PV
mov [rsp+24], r8
mov [rsp+32], r9
sub rsp, 0x28
mov ecx, 0x047D47D57
mov ecx, 0x0CD9FF0DB
call SW3_GetSyscallNumber
add rsp, 0x28
mov rcx, [rsp+8]